DLP after generative AI: the leak is now a prompt
In plain words: Secrets used to leak by email or memory stick; now they leak when someone pastes them into an AI chat, so give people a safe AI to use instead of banning it. Data protection, explained simply
In short
- Data loss prevention was built to watch files and channels: email, web uploads, removable drives. Generative AI added a route that looks like neither. The leak is a paragraph of text typed or pasted into a prompt.
- Bans push people to personal accounts and phones, where nothing is watched at all.
- What works is a sanctioned assistant that is safe to use, controls that read the prompt as well as the file, and a short list of data that must never go in.
How the leak changed
In spring 2023 Samsung engineers pasted internal source code and meeting notes into a public chatbot to get help with their work. Samsung responded by banning generative AI tools on company devices. It is the best-known case, but the pattern is everywhere: someone with a real task and a deadline pastes in the customer complaint, the contract clause, the spreadsheet of names, because the tool is good at the job.
Nothing in that action looks like data theft to older controls. There is no attachment and no file transfer, only text in a browser form, often over an encrypted connection to a site that is allowed for other reasons. OWASP lists sensitive information disclosure as the second of its top ten risks for applications built on large language models, and that is before counting what users type in themselves.
Why bans fail
A ban sounds decisive and mostly moves the problem. People who find the tools useful keep using them, on a personal laptop or a phone, with a personal account whose terms may allow the provider to keep and learn from what is typed. The organisation loses sight of the data and the chance to steer behaviour. My own view is that a ban is a holding measure for a few weeks at most, while a safe option is put in place.
What works instead
- A sanctioned assistant. An enterprise service with contractual terms on retention and training, sign-in through the organisation's identity provider and its own logging. If the approved tool is good, most people will use it.
- Controls that read the prompt. Modern data protection tools and browser controls can inspect what is pasted or typed into AI sites and apply the same rules as for email: warn, block, or let it through with a reason. Coaching at the moment of the paste changes more behaviour than any annual training.
- A short "never" list. Customer personal data, credentials and keys, unreleased financial results, source code for key systems. Keep it short enough to remember.
- The same classification. Labels that already drive email and file controls should drive AI controls too, so there is one policy rather than two.
The DLP Framework on this site covers the wider programme, including a chapter on AI and data loss.
What to do on Monday
- Find out which AI tools people actually use. Web proxy and identity logs usually answer this within a day.
- Make one good assistant available, with enterprise terms, and say clearly that it is the approved one.
- Extend existing data protection rules to the prompt, starting in warn mode so you learn before you block.
- Publish the "never" list in one paragraph and put it where people paste.
Sources
- Forbes Australia, Samsung bans ChatGPT among employees after sensitive code leak (May 2023).
- OWASP, LLM02:2025 Sensitive Information Disclosure, in the Top 10 for LLM Applications 2025.
- NCSC and CISA, Guidelines for secure AI system development (2023).
- DLP Framework, on this site.
Personal work and my own view, not my employer's. Sources are public.